Data Privacy Rights in Maine
Written in plain language for general understanding. This is educational content, not legal advice. Content is researched from federal statutes, state codes, and official government sources. Each article is reviewed for accuracy before publication. Our editorial process
What is this right?
The United States does not have a single comprehensive federal data privacy law like the EU's GDPR. Instead, privacy is protected through a patchwork of federal sector-specific laws and an expanding number of state privacy laws. Several states — led by California — have passed comprehensive consumer privacy laws giving you the right to know what data companies collect about you, to delete it, and to opt out of its sale.
At the federal level, key privacy laws include HIPAA (health data), FERPA (education records), COPPA (children under 13), GLBA (financial data), and the FTC Act (unfair or deceptive practices). For general consumer data — your browsing history, purchase history, location data, and online behavior — state laws provide the most protection.
When does it apply?
Your data privacy rights apply when:
- A company collects, stores, or sells your personal data — including name, email, phone, location, browsing history, and purchase history
- You want to know what data a company has about you
- You want a company to delete your personal data
- You want to opt out of the sale or sharing of your personal data
- A company experiences a data breach that exposes your information
State privacy laws (as of 2026):
- California (CCPA/CPRA): The strongest state privacy law. Right to know, delete, opt out of sale/sharing, correct inaccurate data, and limit use of sensitive data. Applies to businesses with $25M+ revenue, data on 100,000+ consumers, or 50%+ revenue from data sales. Enforced by the California Privacy Protection Agency.
- Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and 10+ other states have passed comprehensive privacy laws with varying effective dates through 2026. Most include rights to access, delete, correct, and opt out.
- States without privacy laws: If your state doesn't have a comprehensive privacy law, your primary protection is the FTC's authority to pursue "unfair or deceptive" data practices.
Common misconceptions:
- "I have no privacy rights because there's no federal privacy law" — While there's no comprehensive federal law, sector-specific federal laws and state laws provide significant protections depending on the type of data and where you live.
- "If a service is free, they can do anything with my data" — No. Companies must disclose their data practices in a privacy policy, and state laws may give you opt-out rights regardless of whether you paid for the service.
- "Deleting my account deletes my data" — Not necessarily. Companies may retain data for legal or business reasons. Under state privacy laws, you can submit a specific deletion request that the company must honor.
What should you do?
Step 1: Check whether your state has a comprehensive privacy law. If you are in California, Colorado, Connecticut, Virginia, Texas, or one of the other states with privacy laws, you have specific rights you can exercise.
Step 2: Submit a data access request to any company you want to know about. Most companies have a "Privacy" or "Do Not Sell My Information" link in their website footer. California residents can use the phrase "right to know" in their request.
Step 3: Opt out of data sales. Under California law and similar state laws, companies must provide a clear mechanism to opt out. Look for "Do Not Sell or Share My Personal Information" links.
Step 4: If your data was exposed in a breach, check whether your state requires the company to notify you and offer credit monitoring. Most states have breach notification laws.
Step 5: File complaints with your state attorney general (most state privacy laws are enforced by the AG) or with the FTC at reportfraud.ftc.gov. California residents can also file with the California Privacy Protection Agency.
What should you NOT do?
Don't ignore data breach notifications. If a company tells you your data was compromised, take it seriously. Change passwords, enable two-factor authentication, and monitor your credit.
Don't accept cookies without thinking. Many websites use cookie banners that default to accepting all tracking. Choose "Reject All" or customize your settings to limit data collection.
Don't assume privacy policies protect you. Most privacy policies are written to maximize what the company can do with your data, not to protect you. Read the sections on data sharing, third parties, and your rights.
Don't pay for data removal services without researching them. Some data removal services charge fees for actions you can take yourself for free under state law. Submit your own requests first.
How Maine differs from federal law
Maine has enacted notable data privacy protections, particularly for internet service provider (ISP) customers:
- Maine ISP Privacy Law (35-A M.R.S.A. § 9301, 2019): Maine was the first state to enact a law preventing ISPs from using, disclosing, selling, or providing access to customers' personal data without opt-in consent. This law applies to broadband internet providers operating in Maine and covers browsing history, app usage data, geolocation data, and other personal information.
- Maine Unfair Trade Practices Act (5 M.R.S.A. § 205-A et seq.): Prohibits unfair and deceptive business practices, which can include misuse of consumer data. The Attorney General enforces this law against businesses that mislead consumers about data practices.
- Data breach notification (10 M.R.S.A. § 1346 et seq.): Requires businesses to notify affected Maine residents within a reasonable time of discovering a data breach involving personal information. The Attorney General must also be notified.
- No comprehensive privacy law (yet): Unlike California or Colorado, Maine does not have a comprehensive consumer data privacy law granting broad rights to access, delete, or opt out of data sales. However, the ISP law provides strong protections in that specific area.
- Student privacy: Maine has protections for student data under state education law, limiting how schools and ed-tech companies can use student information.
Additional Steps in Maine
File ISP privacy complaints with the Maine Office of the Public Advocate at (207) 624-3687 or the Maine Attorney General at (207) 626-8849. For data breaches, monitor your credit reports and consider placing a fraud alert or credit freeze.
Relevant Law: 35-A M.R.S.A. § 9301 (ISP privacy law), 10 M.R.S.A. § 1346 et seq. (data breach notification), 5 M.R.S.A. § 205-A (Unfair Trade Practices Act)
Common Questions
When does data privacy rights apply?
Your data privacy rights apply when:A company collects, stores, or sells your personal data — including name, email, phone, location, browsing history, and purchase historyYou want to know what data a company has about youYou want a company to delete your personal dataYou want to opt out of the sale or sharing of your personal dataA company experiences a data breach that exposes your informationState privacy laws (as of 2026):California (CCPA/CPRA): The strongest state privacy law. Right to know, delete, opt out of sale/sharing, correct inaccurate data, and limit use of sensitive data. Applies...
What should I do about data privacy rights?
Step 1: Check whether your state has a comprehensive privacy law. If you are in California, Colorado, Connecticut, Virginia, Texas, or one of the other states with privacy laws, you have specific rights you can exercise.Step 2: Submit a data access request to any company you want to know about. Most companies have a "Privacy" or "Do Not Sell My Information" link in their website footer. California residents can use the phrase "right to know" in their request.Step 3: Opt out of data sales. Under California law and similar state laws, companies must provide a clear mechanism to opt out. Look for...
What mistakes should I avoid with data privacy rights?
Don't ignore data breach notifications. If a company tells you your data was compromised, take it seriously. Change passwords, enable two-factor authentication, and monitor your credit.Don't accept cookies without thinking. Many websites use cookie banners that default to accepting all tracking. Choose "Reject All" or customize your settings to limit data collection.Don't assume privacy policies protect you. Most privacy policies are written to maximize what the company can do with your data, not to protect you. Read the sections on data sharing, third parties, and your rights.Don't pay for da...
Legal Resources
We may earn a commission if you use these services — at no extra cost to you. This supports our mission to make legal information free for everyone.